MAL-2026-127

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@bingads-webui-component-legacy/storage/MAL-2026-127.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-127
Published
2026-01-07T13:45:41Z
Modified
2026-01-08T09:35:22.325479Z
Summary
Malicious code in @bingads-webui-component-legacy/storage (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b1b0ef4dc1d3bac0f76b00b2134e0e39c61034e61e307a6390e8c92dacad80c2)

The package @bingads-webui-component-legacy/storage was found to contain malicious code.

Source: ossf-package-analysis (ca5cab7ae6e72da40ce41754bd8420123f07157eb86bb9c3b6232a9802a6a7bc)

The OpenSSF Package Analysis project identified '@bingads-webui-component-legacy/storage' @ 99.9.9 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "ca5cab7ae6e72da40ce41754bd8420123f07157eb86bb9c3b6232a9802a6a7bc",
            "source": "ossf-package-analysis",
            "modified_time": "2026-01-07T13:45:41Z",
            "import_time": "2026-01-07T13:46:18.489039689Z",
            "versions": [
                "99.9.9"
            ]
        },
        {
            "sha256": "b1b0ef4dc1d3bac0f76b00b2134e0e39c61034e61e307a6390e8c92dacad80c2",
            "source": "amazon-inspector",
            "modified_time": "2026-01-08T09:02:00Z",
            "import_time": "2026-01-08T09:11:28.824152733Z",
            "versions": [
                "99.9.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @bingads-webui-component-legacy/storage

Package

Name
@bingads-webui-component-legacy/storage
View open source insights on deps.dev
Purl
pkg:npm/%40bingads-webui-component-legacy/storage

Affected ranges

Affected versions

99.*
99.9.9

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@bingads-webui-component-legacy/storage/MAL-2026-127.json"